Still, the proposal matters. It shows what the SEC expects around governance, risk assessment, incident response, disclosure and evidence. Registered advisers, funds, boards, compliance officers and security leaders can use it as a yardstick, because related duties under existing rules remain in force.
This guide covers the original proposal, its withdrawal, the obligations that still apply, and practical steps you can take now. It is general information, not legal advice. Confirm your obligations with securities counsel.
Key Takeaways
- The SEC proposed adviser and fund cybersecurity rules in 2022 and withdrew them in June 2025.
- The proposal centered on written policies, risk assessments, 48-hour incident reporting, disclosures and records.
- Withdrawal leaves compliance, privacy, identity-theft and recordkeeping duties intact.
- Use the proposal as a gap-assessment reference, and confirm active obligations with counsel.
What Was the SEC Proposed Cybersecurity Rule, and What Is Its Status?
The proposal in context
The SEC issued the proposal on February 9, 2022 (Release IA-5956, File S7-04-22). Its stated concern: weaker cybersecurity practices can leave investor-protection gaps, and advisers depend heavily on technology and interconnected service providers. Goals included better preparedness, reduced investor risk, and improved disclosure of risks and incidents.
The proposed package included:
- Rule 206(4)-9, requiring adviser cybersecurity policies and procedures
- Rule 204-6 and Form ADV-C, for confidential incident reporting
- Form ADV Part 2A amendments, for risk and incident disclosure
- Amendments to Rule 204-2, for cybersecurity records
- Rule 38a-2, the parallel fund provision
What changed after the proposal
| Event | Date |
|---|---|
| Proposal issued | February 9, 2022 |
| Federal Register publication | March 9, 2022 |
| Comment period closed | April 11, 2022 |
| Comment period reopened | March 15, 2023 (deadline May 22, 2023) |
| Withdrawal notice | June 12, 2025 |
| Withdrawal published | June 17, 2025 |
A proposed rule is not a final rule, and a withdrawn proposal is neither. The SEC's Federal Register notice confirms the withdrawal. No later replacement proposal has been announced, and any future action would need new rulemaking. Check the SEC docket before relying on this.
Why it remains relevant
The proposal is a useful benchmark for governance, incident escalation, vendor oversight, risk assessment and board reporting. Treat these as preparedness practices, not legal conclusions.
What Would the Proposed Rule Have Required?
Written policies and the five program elements
Proposed Rule 206(4)-9 would have required registered advisers to adopt and implement written policies reasonably designed to address cybersecurity risks. They had to fit the adviser's systems, data, clients, providers and risk profile, not a generic template.
| Element | Proposed subject matter |
|---|---|
| Risk assessment | Periodic, documented assessments; inventory-based prioritization; provider risks |
| User security and access | Authentication with two or more credentials; job-necessary access; secure remote access |
| Information protection | System monitoring; protection against unauthorized access or use |
| Threat and vulnerability management | Detecting, mitigating and remediating weaknesses |
| Incident response and recovery | Response, recovery, continued operations, communications, reporting, documentation |
Multi-credential authentication appeared in the proposed text. Encryption and network segmentation were illustrative measures, not mandates. The proposal also called for at least annual review, with a written report covering tests, results, incidents and material policy changes.
Significant incident reporting on Form ADV-C
Advisers would have filed a confidential Form ADV-C promptly, and no later than 48 hours after having a reasonable basis to conclude a significant incident occurred or was occurring. Certain updates would also have been due within 48 hours.
An incident was "significant" if it:
- Significantly disrupted or degraded critical operations of the adviser or a private fund client, or
- Involved unauthorized access to adviser information causing substantial harm to the adviser, a client or a private fund investor.
That 48-hour clock was part of the withdrawn proposal. Do not confuse it with state, contractual or other SEC notification timelines.
Disclosures and books and records
Part 2A would have gained a new Item 20. It would have covered material cyber risks, how they are assessed and addressed, and incidents from the past two fiscal years. Disclosures would need to match actual controls and real incidents.
The Rule 204-2 amendments would have required keeping these for five years:
- Cybersecurity policies (current or in effect within the prior five years)
- Annual reports and risk-assessment records
- Form ADV-C filings and amendments
- Records of any incident, not only significant ones
Existing Rule 204-2 retention separately runs five years from the end of the fiscal year of the last entry, with the first two years in an appropriate adviser office, subject to exceptions.
Who Would Have Been Affected and What Would Governance Have Looked Like?
Covered entities
The proposal reached SEC-registered and required-to-register advisers, plus registered investment companies and business development companies. Exempt reporting advisers fell outside Form ADV-C's registration-based obligation. This article focuses on advisers and touches fund provisions only for context.
Third-party providers and proportionality
Policies would have had to account for providers that handle information or access systems, including written contracts with protective measures. Size mattered less than complexity: cloud platforms, outsourcing, and client services all shape the risk.
Outsourcing does not transfer governance. A managed service can run tasks, but it cannot own your business decisions.
Practical steps still apply:
- Assign one internal owner per capability even when a vendor does the daily work
- Review vendors monthly using evidence such as cases, response times, and tuning changes
- Map concentration risk across one cloud, one identity provider, or one MSP
Board and executive oversight
The proposal translates into plain governance questions:
- Who owns the risk?
- Who can declare an incident?
- Who escalates it, and to whom?
- What evidence reaches the board?
Boards cannot delegate accountability for oversight of material risk, readiness funding, and disclosure posture. Tyson Martin's approach to board reporting fits that model:
- Plain-English risk posture
- What changed since the last briefing
- A stable dashboard that shows trend, not trivia
- Decision rights that hold in real incidents
How Does the Proposal Fit With Current SEC Obligations?
Withdrawal of the proposal does not erase existing cyber-related duties. Those rules still apply on their own.
Rule 206(4)-7 compliance program
Registered advisers need written policies to prevent Advisers Act violations, an at-least-annual review, and a chief compliance officer. This is not the withdrawn proposal, but cybersecurity responsibilities can be documented inside it. Have counsel or a specialist review any gaps.
Regulation S-P
The 2024 amendments were adopted May 15, 2024 and took effect August 2, 2024. Larger entities, including advisers with $1.5 billion or more in assets under management, had to comply by December 3, 2025. Smaller entities must comply by June 3, 2026.
Key requirements under 17 CFR 248.30:
- Written safeguards and an incident response program
- Customer notice as soon as practicable, within 30 days of becoming aware of actual or reasonably likely unauthorized access
- Service-provider oversight, with providers notifying the firm within 72 hours of a breach
Note the contrast: the proposed 48-hour clock went to the SEC, while the 30-day clock goes to affected customers.
Regulation S-ID
S-ID requires a written red-flags program only if the adviser qualifies as a financial institution or creditor and offers or maintains covered accounts. It is not automatic for every adviser. A program typically covers:
- Identifying, detecting, and responding to red flags
- Periodic program updates
- Initial board or committee approval
- Ongoing oversight, training, and provider oversight
Rule 204-2 and other requirements
Rule 204-2 requires specified records, including:
- Accounting, order, and communications records
- Agreements, advertising, ethics, brochure, and policy records
- Annual-review documentation
Map compliance evidence to the current provisions rather than the withdrawn proposal.
State breach-notification laws, contracts, insurance conditions and Form ADV disclosures may also apply. Verify against current SEC rules, state regulators and qualified counsel.
The SEC's FY2027 priorities highlight cyber governance, access, response and recovery, providers, and S-P and S-ID. They are nonbinding, but they show where examiners look.
How Should an Investment Adviser Prepare Now?
Establish governance and decision rights
Name accountable owners for risk, incident classification, regulatory notification, client communication, vendor escalation and board reporting. Keep decision rights explicit so response work does not stall.
- The board approves exceptional actions such as ransom-payment posture, major shutdown tradeoffs and public risk statements.
- The CISO leads containment and investigation; the CIO or CTO executes shutdown and recovery.
- General Counsel owns legal strategy and regulator engagement.
The board oversees without slowing the response.
Build a risk and data inventory
Map what you hold and who can reach it:
- Client and firm data
- Critical systems and privileged accounts
- Cloud services and remote-access paths
- Portfolio tools and third parties with access
Document the risk assessment with assumptions, impact, treatment decisions, owners and review dates. Redo it annually and after major changes such as a cloud migration or acquisition. NIST CSF 2.0 is a non-prescriptive framework worth using.
Test safeguards and vendor oversight
Start with the basics:
- MFA on email, VPN, cloud consoles and admin portals
- Least-privilege access and protected backups
- Logging, training and vendor due diligence
Written policies are not enough. Keep evidence such as access reviews, closed tickets, restore logs, training completions, vendor assessments and control-test results.
Prepare and exercise incident response
Write a playbook covering detection, severity, legal review, escalation, communications, evidence preservation, recovery and lessons learned. Keep call trees current and test them after hours.
Then run a tabletop on a significant adviser incident. Test whether your firm could make timely, defensible decisions inside a 48-hour window. That is a stress test, not a binding deadline. Run at least one executive tabletop a year.
Create board-ready reporting and a 90-day plan
Report trends, open remediation, vendor issues, readiness, test results and decisions needed. Contrast activity with exposure: closing 97 percent of critical vulnerabilities means little if one unpatched system halts customer onboarding for 48 hours.
A 90-day plan should include:
- Days 1 to 30: map critical assets, rank top risks, name incident roles
- Days 31 to 60: assign owners and dates, build the playbook
- Days 61 to 90: set milestones, run the tabletop, deliver board reporting
A board advisor or interim CISO can help clarify ownership and turn evidence into credible oversight. Tyson Martin offers this as optional support. It does not replace legal or regulatory advice, and the work excludes running security tools or rewriting policies.
Frequently Asked Questions
Who regulates investment advisers and what SEC rules apply?
The SEC oversees federally registered advisers (generally $100 million+ in assets); state regulators oversee state-registered ones. Relevant rules include Rule 206(4)-7, Regulation S-P, S-ID where applicable, and Rule 204-2. Verify your registration status.
What is the SEC proposed cybersecurity rule for investment advisers?
It was a 2022 framework of written policies, risk assessments, incident reporting, disclosures and records. The SEC withdrew it in June 2025, so it is not an enforceable requirement.
What records does SEC Rule 204-2 require?
Advisers must keep specified business records, generally five years from the end of the fiscal year of the last entry, the first two in an appropriate office. The extra cybersecurity records existed only in the withdrawn proposal.
What is the SEC code of ethics rule for investment advisers (Rule 206(4)-1)?
Rule 206(4)-1 is the Marketing Rule. The code of ethics rule is Rule 204A-1. Neither is the withdrawn cybersecurity rule.
